OpenClaw published v2026.7.1-2, a focused stable patch for npm plugin updates. The release notes say the fix lets OpenClaw accept singleton-array metadata from newer npm clients so tracked official plugins can install and update to correction releases.
That sounds small, but it sits in a sensitive part of the platform. OpenClaw's plugin system has been moving through the bundled-to-external transition, where official capabilities can ship as managed external plugins instead of being permanently baked into core. During that transition, install and update paths need to tolerate real npm registry output while still failing closed when the requested package or version is wrong.
This patch is tied to PR #108336, which fixed several related install and doctor resilience bugs around official plugin handling.
Why The Patch Matters
The underlying PR describes three failure classes around plugin metadata and migration:
- official plugin config could be dropped when an official external plugin was allowed but not installed yet
- npm metadata normalization could reject valid registry shapes
- a plugin registration path could crash command suggestions by touching state too early
The release itself highlights the npm metadata piece. Newer npm clients can return metadata as singleton arrays. OpenClaw now accepts that shape for tracked official plugins, allowing managed plugin installs and correction-release updates to continue.
The PR also says metadata handling now covers object and multi-version array output, selects the maximum satisfying semver instead of assuming publication order, accepts flat and nested dist fields, tolerates missing openclaw blocks, and reports missing fields explicitly.
Better Upgrade Behavior
For operators, the practical benefit is less upgrade fragility. A machine moving through the official-plugin transition should not lose an allowed plugin entry merely because the external package has not been installed yet. It should report an actionable installed-state problem.
Likewise, an npm metadata response with a valid package shape should not block Gateway startup or plugin installation just because the registry returned data in a slightly different JSON form.
The fail-closed side is important too. PR #108336 says OpenClaw refuses recognized ranges that have no satisfying entry rather than silently resolving outside the requested constraint.
Context From The Prior Stable Patch
The release landed one second after v2026.7.1-1, which carried a broader stable maintenance set: Codex progress replies reaching terminal responses, Memory Core startup repair, guarded WSL state permission handling, legacy migration recovery, and managed plugin lock repair.
Taken together, the two stable patches are less about new features and more about keeping existing OpenClaw installations healthy through updates, startup repair, and managed plugin migration.
Validation
PR #108336 reports focused passing coverage across install-source utilities, doctor stale-plugin config, plugin auto-enable and validation, and Codex plugin registration. It also records a green changed-surface gate and a clean autoreview after fixes for semver selection and unmatched-range handling.
For OpenClaw users who rely on official managed plugins, v2026.7.1-2 is a small but useful correction release: plugin metadata parsing is more tolerant where the npm ecosystem varies, while version selection remains strict where safety depends on it.